CVE-2026-94127: Memory Corruption at the Access Boundary

Executive Summary

On September 22, 2026, F5 disclosed CVE-2026-94127, a critical heap-based buffer overflow affecting certain BIG-IP Access Policy Manager deployments.

An unauthenticated attacker with network access to a vulnerable virtual server can send specially crafted traffic and potentially execute arbitrary code. F5 says exploitation has occurred in the wild, and CISA added the vulnerability to KEV on the same day.

The configuration requirement matters: exploitation requires an APM access policy and an OAuth authorization-server profile on the same virtual server. Deployments functioning only as OAuth clients or resource servers are not affected by this vulnerability.

This is exactly the kind of vulnerability offensive-security teams should study because it combines memory corruption, authentication infrastructure and an edge device that often sits directly in front of sensitive internal resources.

Vulnerability Snapshot

Field	Verified Information
CVE	CVE-2026-94127
Product	F5 BIG-IP APM
Class	Heap-based Buffer Overflow / CWE-122
CVSS 3.1	9.8
Authentication	None
User Interaction	None
Configuration Required	APM policy + OAuth authorization profile
Impact	Arbitrary code execution / full compromise
Exploitation	Confirmed
CISA KEV	Yes
Patch	Engineering hotfixes available

What Is Vulnerable?

BIG-IP APM provides access-control capabilities for applications and enterprise resources.

In affected deployments, the vulnerable virtual server participates in OAuth authorization processing while also applying an APM access policy.

That makes this more than a conventional load-balancer vulnerability.

The affected system can be positioned directly inside an organization’s authentication and remote-access architecture.

Technical Analysis

The publicly documented weakness is a heap-based buffer overflow.

Heap corruption occurs when software writes beyond the bounds of dynamically allocated memory. Depending on the corrupted structures and attacker control, consequences can range from a process crash to arbitrary code execution.

F5 and government advisories state that specially crafted traffic can trigger the condition remotely.

The important qualifier is configuration.

This is not universally exploitable across every BIG-IP installation. The affected virtual server must have both:

1. an APM access policy, and
2. an OAuth authorization-server profile.

That requirement should be incorporated into vulnerability triage rather than treating every BIG-IP host as equivalently exposed.

Detailed exploit mechanics sufficient to reproduce the vulnerability should not be inferred from the public advisory.

Attacker’s Perspective

An exposed access gateway is a high-value target because it already occupies the path between external users and protected applications.

Successful RCE changes the attacker’s position from:

outside the access boundary

to:

executing code on infrastructure implementing that boundary.

That is strategically valuable even before considering any specific post-exploitation technique.

Conceptual Attack Path

Internet
↓
BIG-IP virtual server
↓
APM + OAuth authorization configuration
↓
Crafted traffic
↓
Heap corruption
↓
Remote code execution
↓
Gateway compromise
↓
Authentication/configuration discovery
↓
Potential access to adjacent internal resources

Only the path through RCE is confirmed by the vulnerability documentation. Subsequent movement is deployment-dependent analysis.

Why This Matters for Offensive Security

Edge appliances deserve deliberate enumeration.

An external assessment should not stop at determining that an IP address runs HTTPS.

Identify the function.

Is it:

• a reverse proxy?
• an access gateway?
• a VPN?
• an OAuth authorization service?
• a load balancer?
• an administrative interface?

Those distinctions affect exploitation potential.

Safe reconnaissance can include TLS certificate inspection, HTTP fingerprinting, DNS analysis and approved service discovery.

For example:

nmap -sV -p 443 <authorized-target>

or:

openssl s_client -connect <authorized-target>:443 -servername <hostname>

These do not exploit CVE-2026-94127. They illustrate the reconnaissance phase necessary to understand whether edge infrastructure exists in the authorized scope.

Defender Detection

Because F5 has confirmed real-world exploitation, organizations should approach vulnerable systems as potential incident-response targets rather than merely items on a patch list.

Defenders should review:

• traffic reaching affected virtual servers;
• unexpected process behavior;
• crashes or service instability;
• configuration modifications;
• unexpected outbound connections;
• authentication anomalies;
• privileged administrative activity.

Network telemetry external to the BIG-IP system is particularly useful when investigating possible appliance compromise.

Mitigation

F5 released engineering hotfixes for affected branches. Government guidance identifies fixes for the 17.1, 17.5 and 21.1 branches.

Administrators should first determine whether affected virtual servers combine an APM access policy with an OAuth profile.

Then:

1. apply the appropriate F5-supported hotfix;
2. reduce unnecessary exposure;
3. review telemetry for activity predating remediation;
4. investigate suspicious systems as potential compromises rather than assuming patching removes prior access.

Broader Security Lesson

Edge security infrastructure creates a concentration of trust.

It terminates sessions.

It understands identity.

It mediates access.

It frequently sees traffic before endpoint security products do.

That makes exploitation of the gateway disproportionately valuable.

CVE-2026-94127 illustrates why network architecture diagrams should double as attacker-value maps. The components connecting trust zones deserve scrutiny precisely because they connect trust zones.

Key Takeaways

• CVE-2026-94127 is a critical BIG-IP APM heap-based buffer overflow.
• Exploitation can result in unauthenticated RCE.
• F5 confirms exploitation in the wild.
• CISA added it to KEV on September 22.
• Only specific APM/OAuth configurations are vulnerable.
• Edge access infrastructure should be explicitly enumerated during offensive-security assessments.

References

• F5 — K000162605: BIG-IP APM vulnerability CVE-2026-94127. F5 Security Advisory
• Canadian Centre for Cyber Security — AL26-022. Cyber Centre Alert
• Canadian Centre for Cyber Security — AV26-949. Cyber Centre F5 Advisory
• Rapid7 — Critical Unauthenticated RCE in F5 BIG-IP APM. Rapid7 Analysis

Red Brixen Research Notes

Research Confidence: High
Confirmed Exploitation: Yes
Public PoC: Reports exist; not required or reproduced here
CISA KEV: Yes
Primary Sources Consulted: F5, CISA-derived KEV reporting, Canadian Centre for Cyber Security
Last Verified: September 25, 2026